API Key Security

Overview

WPiko AI Chatbot uses your OpenAI API key to talk to OpenAI. Anyone with that key can spend your OpenAI credit, so the plugin stores and uses it carefully. This page explains how, and what you can do to keep it safe.

How the Key Is Stored

• Encrypted: the key is encrypted with AES-256-CBC before it’s saved, using your site’s own WordPress AUTH salt as the encryption key. Each WordPress site has a different salt.
• Location: the encrypted key is saved in the WordPress options table as wpiko_chatbot_api_key.
• Never shown in full: after saving, only the last 5 characters are shown on the API Connection screen.
• Never sent to browsers: all calls to OpenAI are made from your server over HTTPS. The key is never included in pages or JavaScript.

Managing the Key

Go to WPiko AI Chatbot → AI & Training → AI Settings → API Connection:

• Add or replace it: paste the key and click Save and Test API Key. A new key overwrites the old one.
• Remove it: click Delete API Key and confirm. The key is removed from the database and the chatbot stops answering until a new key is saved.

Only users who can manage options (Administrators) can see or change these settings, and every save or delete is protected by a WordPress nonce. See API Key Configuration for the full setup.

Note: because the key is encrypted with your WordPress salts, changing the AUTH_KEY or AUTH_SALT in wp-config.php (or moving to a site with different salts) means the saved key can’t be read any more. Save the key again after such a change.

Best Practices

• Create a separate OpenAI project and key for each website, so you can revoke one without affecting others.
• Set a monthly budget limit in your OpenAI account, and keep User Limits on.
• Check your OpenAI usage regularly for anything unexpected.
• Give Administrator access only to people who need it, and keep WordPress, your plugins and themes updated.
• Use HTTPS on your whole site.

If Your Key Is Compromised

1. Revoke the key in your OpenAI dashboard straight away.
2. Create a new secret key and save it in AI Settings → API Connection.
3. Review your OpenAI usage for unauthorized activity.
4. Find out how it leaked (for example a shared admin account or an insecure plugin) and fix it.

For Developers

• Read the key with wpiko_chatbot_decrypt_api_key( get_option( 'wpiko_chatbot_api_key' ) ). Never read the option directly and use it as a key.
• Never write the decrypted key to logs, sessions, transients or the browser.
• Make any custom OpenAI calls from the server only.